4 ms·

The GDPR is certainly to blame for all of those dumb emails you're getting. "in the UK the Information Commissioner has made it clear it won't be heavy-handed

by pg_bot 8y ago

The GDPR is certainly to blame for all of those dumb emails you're getting. "in the UK the Information Commissioner has made it clear it won't be heavy-handed with fines" Unless the information commissioner is immortal and is appointed for life there are no guarantees that this will always be the case. Companies read the law and see that they can be fined up to €20 million or 4% of their annual revenue (whichever is greater) and act accordingly. The GDPR is especially pernicious as its scope reaches beyond the boundaries of the European Union. If you're an American company and a single European citizen uses your services you are bound by the GDPR's regulations. Some people claim that the court system in the EU is more judicious than the United States. For those people I want to ask "Why should I trust the opinion of the people who are going to sue me if I am found to be noncompliant". If you think the people covering their butts are being irrational, read the law again. https://gdpr-info.eu/ https://gdpr-info.eu/

tjoff 8y ago
I'd rephrase it as: GPDR is to thank for those emails. And also an indication that GPDR might be working.
BillinghamJ 8y ago
> If you're an American company and a single European citizen uses your services you are bound by the GDPR's regulations. That isn’t really true. If you have no legal presence, no employees, no offices, etc in Europe, enforcement actions cannot be taken against you. The law may say you’re in scope, but that’s only relevant within areas where EU laws have any weight.
- fwdpropaganda 8y ago
  Please read this https://news.ycombinator.com/item?id=17058645 https://news.ycombinator.com/item?id=17058645 It's not that the law wants to apply to you but it doesn't have weight because they can't enforce anything against you, as is often heard on HN. It's that the law doesn't want to apply to you.
FooBarWidget 8y ago
> If you're an American company and a single European citizen uses your services you are bound by the GDPR's regulations. This is false. I blogged about this topic a while ago: https://www.joyfulbikeshedding.com/blog/2018-04-17-should-non-eu-websites-ban-eu-visitors-under-the-gdpr.html https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no... The criterium for whether a non-EU company needs to comply to GDPR is: does the company intent to seriously service EU citizen? This is determined based on multiple factors, such as the website's language (do they have e.g. German translations?), providing pricing in euros, testimonials from EU customers, or having a contract with a parcel company with the specific intention of delivering to EU customers. The mere fact that the website can be used by an EU citizen is not enough to have it fall under the GDPR. Source: the book "Handbook GDPR, Compliance in practice" (page 11) by Arnoud Engelfriet & co, a Dutch IT lawyer. https://ictrecht.nl/boeken/handboek-avg-compliance-in-de-praktijk/ https://ictrecht.nl/boeken/handboek-avg-compliance-in-de-pra...
- fwdpropaganda 8y ago
  > The criterium for whether a non-EU company needs to comply to GDPR is: does the company intent to seriously service EU citizen? This is determined based on multiple factors, such as the website's language (do they have e.g. German translations?), providing pricing in euros, testimonials from EU customers, or having a contract with a parcel company with the specific intention of delivering to EU customers. The mere fact that the website can be used by an EU citizen is not enough to have it fall under the GDPR. Hey, thanks a lot for this. It seems these days the noise is larger than the signal. Hard to find anyone putting careful thought into this. Thank you.
  - cdjk 8y ago
    The blog post references a secondary source in Dutch. I’d be careful before relying on that for legal advice.
    - FooBarWidget 8y ago
      Said secondary source however is written by a lawyer. A lawyer specialized in IT even.
jdietrich 8y ago
The GDPR is perfectly straightforward to interpret and apply. It's remarkably similar to the existing Data Protection Directive. If you are using data in a specific, explicit and legitimate way, you have nothing to fear from the GDPR. It only seems radical because tech companies have operated with relative impunity in the past, hoovering up data en masse with no regard to the privacy or security of their users. Article 83 clearly states that penalties must be proportionate to the scale of the breach, the impact on users, the intentional or negligent character of the breach and the degree of co-operation with the supervisory authority. A supervisory authority can't just bankrupt your company out of spite. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ Your bio says that you're a founder of a company that processes healthcare data. The maximum civil penalty for HIPAA violation is a fine of $50,000 per violation and there have been several multimillion dollar penalties. The maximum criminal penalty is 10 years imprisonment. If you're worried about GDPR, you should be absolutely terrified of HIPAA.
- pg_bot 8y ago
  I'm not worried about it for my company, just putting into perspective why other people might be.
- coldcode 8y ago
  Why, I used to be a HIPPA architect and basically the government (and even more this one) ignored all evidence of HIPPA violations. Our compliance was a complete joke, covered by some fancy "audit" which failed to ask a single question. Laws don't matter unless they enforced.
- raverbashing 8y ago
  > Your bio says that you're a founder of a company that processes healthcare data. The maximum civil penalty for HIPAA violation is a fine of $50,000 per violation and there have been several multimillion dollar penalties. The maximum criminal penalty is 10 years imprisonment. If you're worried about GDPR, you should be absolutely terrified of HIPAA. Yes, I also find this hilarious, people love to spread FUD about the GDPR, but HIPPA is more serious (though limited in scope).
TeMPOraL 8y ago
> Unless the information commissioner is immortal and is appointed for life there are no guarantees that this will always be the case. Not wishing ill on that particular person, but I actually hope they'll change their mind or get replaced by someone who is heavy-handed with fines. Because that's the whole point. The reason so many people (myself included) are so impatiently waiting for May 25th is because GDPR has teeth, and can actually do some serious damage to companies continuing to abuse people's data. So if companies are now sending those e-mails because they're afraid, I am happy, because it's evidence that GDPR works.
raverbashing 8y ago
> Unless the information commissioner is immortal and is appointed for life there are no guarantees that this will always be the case. Yeah, no. You're wrong. Thanks for the link, if you had actually read it, it would have listed all the criteria for applying penalties. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ > "Why should I trust the opinion of the people who are going to sue me if I am found to be noncompliant" Because that's what people (and lawyers) do in every case concerning regulatory bodies

by pg_bot 8y ago

tjoff 8y ago

I'd rephrase it as: GPDR is to thank for those emails. And also an indication that GPDR might be working.

BillinghamJ 8y ago

> If you're an American company and a single European citizen uses your services you are bound by the GDPR's regulations. That isn’t really true. If you have no legal presence, no employees, no offices, etc in Europe, enforcement actions cannot be taken against you. The law may say you’re in scope, but that’s only relevant within areas where EU laws have any weight.

fwdpropaganda 8y ago
Please read this https://news.ycombinator.com/item?id=17058645 https://news.ycombinator.com/item?id=17058645 It's not that the law wants to apply to you but it doesn't have weight because they can't enforce anything against you, as is often heard on HN. It's that the law doesn't want to apply to you.

FooBarWidget 8y ago

> If you're an American company and a single European citizen uses your services you are bound by the GDPR's regulations. This is false. I blogged about this topic a while ago: https://www.joyfulbikeshedding.com/blog/2018-04-17-should-non-eu-websites-ban-eu-visitors-under-the-gdpr.html https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no... The criterium for whether a non-EU company needs to comply to GDPR is: does the company intent to seriously service EU citizen? This is determined based on multiple factors, such as the website's language (do they have e.g. German translations?), providing pricing in euros, testimonials from EU customers, or having a contract with a parcel company with the specific intention of delivering to EU customers. The mere fact that the website can be used by an EU citizen is not enough to have it fall under the GDPR. Source: the book "Handbook GDPR, Compliance in practice" (page 11) by Arnoud Engelfriet & co, a Dutch IT lawyer. https://ictrecht.nl/boeken/handboek-avg-compliance-in-de-praktijk/ https://ictrecht.nl/boeken/handboek-avg-compliance-in-de-pra...

fwdpropaganda 8y ago
> The criterium for whether a non-EU company needs to comply to GDPR is: does the company intent to seriously service EU citizen? This is determined based on multiple factors, such as the website's language (do they have e.g. German translations?), providing pricing in euros, testimonials from EU customers, or having a contract with a parcel company with the specific intention of delivering to EU customers. The mere fact that the website can be used by an EU citizen is not enough to have it fall under the GDPR. Hey, thanks a lot for this. It seems these days the noise is larger than the signal. Hard to find anyone putting careful thought into this. Thank you.
- cdjk 8y ago
  The blog post references a secondary source in Dutch. I’d be careful before relying on that for legal advice.
  - FooBarWidget 8y ago
    Said secondary source however is written by a lawyer. A lawyer specialized in IT even.

jdietrich 8y ago

The GDPR is perfectly straightforward to interpret and apply. It's remarkably similar to the existing Data Protection Directive. If you are using data in a specific, explicit and legitimate way, you have nothing to fear from the GDPR. It only seems radical because tech companies have operated with relative impunity in the past, hoovering up data en masse with no regard to the privacy or security of their users. Article 83 clearly states that penalties must be proportionate to the scale of the breach, the impact on users, the intentional or negligent character of the breach and the degree of co-operation with the supervisory authority. A supervisory authority can't just bankrupt your company out of spite. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ Your bio says that you're a founder of a company that processes healthcare data. The maximum civil penalty for HIPAA violation is a fine of $50,000 per violation and there have been several multimillion dollar penalties. The maximum criminal penalty is 10 years imprisonment. If you're worried about GDPR, you should be absolutely terrified of HIPAA.

pg_bot 8y ago
I'm not worried about it for my company, just putting into perspective why other people might be.
coldcode 8y ago
Why, I used to be a HIPPA architect and basically the government (and even more this one) ignored all evidence of HIPPA violations. Our compliance was a complete joke, covered by some fancy "audit" which failed to ask a single question. Laws don't matter unless they enforced.
raverbashing 8y ago
> Your bio says that you're a founder of a company that processes healthcare data. The maximum civil penalty for HIPAA violation is a fine of $50,000 per violation and there have been several multimillion dollar penalties. The maximum criminal penalty is 10 years imprisonment. If you're worried about GDPR, you should be absolutely terrified of HIPAA. Yes, I also find this hilarious, people love to spread FUD about the GDPR, but HIPPA is more serious (though limited in scope).

TeMPOraL 8y ago

> Unless the information commissioner is immortal and is appointed for life there are no guarantees that this will always be the case. Not wishing ill on that particular person, but I actually hope they'll change their mind or get replaced by someone who is heavy-handed with fines. Because that's the whole point. The reason so many people (myself included) are so impatiently waiting for May 25th is because GDPR has teeth, and can actually do some serious damage to companies continuing to abuse people's data. So if companies are now sending those e-mails because they're afraid, I am happy, because it's evidence that GDPR works.

raverbashing 8y ago

> Unless the information commissioner is immortal and is appointed for life there are no guarantees that this will always be the case. Yeah, no. You're wrong. Thanks for the link, if you had actually read it, it would have listed all the criteria for applying penalties. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ > "Why should I trust the opinion of the people who are going to sue me if I am found to be noncompliant" Because that's what people (and lawyers) do in every case concerning regulatory bodies